Privacy notice

Who we are

Hustle Lifestyle Collective runs HPC and is responsible for your personal data under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022). The law calls this role the personal data controller.

This notice covers the personal data we collect through this website, and when we contact you about the HPC list, events and memberships.

Questions or requests about your data: email hello@hpc.co.id.

What we collect and when

We collect only what we need for each step.

Joining the HPC list

• If you leave just your email address, we add it to the HPC list in sign-up order. We use it to tell you when HPC opens and, when it’s your turn, to invite you to buy a membership. We don’t send you an email when you sign up this way.
• If you fill in the full sign-up form: your full name, email address and WhatsApp number. You can also tell us what you’re training for, and tick a box to get HPC news, including events. The box starts unticked.
• When you signed up. We contact people in the order they signed up, so we use this time to work out your place in line.
• Your status on the list, for example whether we’ve invited you yet.
• How you found us: the campaign tags in the link you followed, and the address of the page that sent you, if your browser shares it.
• Signing up again with the same email address doesn’t create a second entry. It fills in details we didn’t have, turns on HPC news if you tick that box, and records any new event booking.

If you’re invited to buy a membership

• A private invitation link that works for a limited time, with a record of when we sent it and whether it was used. We send it by email, and our staff may also send it to you on WhatsApp.
• At checkout: your name, email address and WhatsApp number (we ask for any we don’t have yet), and the time you accepted the membership terms.
• Whether you want your name shown on a public member board. It shows the full name you gave us. The box starts unticked, and your name appears only if you tick it.
• Payment details from Midtrans, our payment provider. You enter your card or bank details on Midtrans’s own page, so we never see your full card number, card security code or banking login. Midtrans tells us the result: the order reference, the amount and the payment status, plus details such as the payment method, the bank, a masked card number, a virtual account number and transaction times.
• Your membership records: your membership number, when you paid, and when we emailed your confirmation and receipt.
• Refunds: if we have to refund a payment and can’t do it automatically, for example a bank transfer, we email you to ask for the account holder’s name, the bank and the account number. Your reply stays in our email inbox. We don’t add it to our database. We do keep a record of each refund: the order, why we made it, how, and whether it has been sent.

Event bookings

• If we run an event and you book a place: your full name, email address and WhatsApp number, the division you enter (which can show whether it’s a men’s or women’s division), whether you want HPC news, and how you found us.
• Booking an event also adds you to the HPC list.

When you visit the site

• Page views, counted without cookies by Vercel Web Analytics: the address of the page (including any campaign tags in the link), the site that sent you, and your device type, browser, operating system and country, which Vercel works out from your connection. We don’t send Vercel invitation links, payment references, or visits to our staff pages.
• To stop repeated or automated submissions, our server briefly holds your IP address in its memory when you send a form, together with the email address you entered. We don’t save your IP address to our database.
• Technical logs kept by our providers: the pages requested, with your IP address and browser type (Vercel), requests to our database and staff sign-ins (Supabase), and a record of each email we send (Resend).
• If you use our staff sign-in page, Supabase records the email address you enter and sends it a sign-in link.

When you email or WhatsApp us

• Your message, your contact details, and anything else you choose to send us. Email replies reach our inbox. WhatsApp messages are kept by WhatsApp and on our staff’s WhatsApp accounts.

Our sign-up, booking and checkout forms don’t ask for your date of birth, ID card number, home address, photos, precise location or health information.

Why we use it

Indonesian law lets us use personal data only on a lawful basis. Here is each basis we rely on, and what we use it for.

• Your consentTo tell you when HPC opens and invite you to buy a membership, if you left just your email address. To take what you’re training for into account when we follow up. To send HPC news and event emails, only if you ticked that box. To show your name on the public member board, only if you ticked that box.
• Steps you ask us to take before a contractTo keep your place on the HPC list, contact you about it by WhatsApp or email, and invite you to buy a membership.
• A contract with youTo sell and run your membership, take payment, send your confirmation and receipt, handle refunds, and run events you book.
• A legal obligationTo keep payment and tax records, and to answer lawful requests from authorities.
• Our legitimate interestsTo keep the site and our systems secure, prevent fraud and spam, and fix faults. To record with your sign-up how you found us, and to count visits, so we know which outreach works.

Where we rely on your consent, you can withdraw it at any time by emailing hello@hpc.co.id. That doesn’t affect anything we did before you withdrew it.

We contact everyone on the HPC list about their place on it, whether or not they ticked the news box.

Who we share it with

We share personal data with the service providers that run parts of HPC for us, and only what each one needs:

• VercelHosts this website, runs our server code, keeps request logs and counts page views.
• SupabaseStores our database, and handles sign-in for our staff.
• ResendSends our emails: sign-up and event booking confirmations, invitations, payment confirmations and receipts, and refund notices.
• MidtransProcesses payments and refunds.
• WhatsApp (Meta)Carries the messages our staff send you, and the ones you send us.
• Our email providerReceives your replies to our emails.

Midtrans and WhatsApp also handle data under their own privacy policies.

Inside HPC, only authorized staff can see the list, invitations and payments.

We also share personal data when the law requires it, for example with a court or a government authority that has the power to ask for it.

If you choose to show your name on the member board, anyone visiting the site can see it, including in the preview image when someone shares a link to the page, and search engines may find the pages it appears on. If you change your mind, email hello@hpc.co.id and we’ll take your name off. Copies that search engines or other sites already made may take time to disappear.

We don’t sell personal data. We don’t use advertising cookies, ad networks or advertising pixels, and we don’t share your data with anyone for advertising.

Data outside Indonesia

Some of our providers store or process personal data outside Indonesia, mainly in Singapore and the United States. Supabase stores our database in Singapore. Vercel, a US company, runs our server code in Singapore and serves the site through its global network. Resend sends our emails from the United States. WhatsApp (Meta) and our email provider may process messages outside Indonesia. Midtrans is a payment provider based in Indonesia, and card payments also pass through the card networks, which may process them abroad.

Indonesian law sets conditions for sending personal data outside Indonesia. To ask how a transfer is protected, email hello@hpc.co.id.

How long we keep it

We use your data only for the purposes above, and only for as long as we keep it.

• The HPC listIf you don’t become a member, we keep your details until 24 months after HPC opens, then delete them, unless you ask to stay on the list. Event bookings are kept the same way, since a booking also puts you on the list. This doesn’t cover payment records we have to keep by law.
• RefundsIf you paid and we refunded you, we keep the payment and refund records for as long as Indonesian law requires, and delete the rest as above.
• HPC newsYour choice is kept with the rest of your details, for the periods above. You can withdraw it at any time.
• MembersFor as long as you’re a member. After that, we keep only payment and tax records, for as long as Indonesian law requires.
• Site analyticsCounted as totals. Vercel keeps them for the time its service sets.
• Spam protectionThe IP address and email address our server holds in memory to stop repeated submissions stay there only briefly, and that copy is never written to our database. Our hosting provider’s logs are covered under Technical logs.
• Technical logsKept by each provider for the limited time its service sets.
• MessagesWe keep emails and WhatsApp chats as long as we need them to help you, and longer only where the law requires, for example for refund records.

Your rights

Under Indonesia’s Personal Data Protection Law, you have the right to:

• Be informed about who we are, why we use your data and how. This notice is part of that.
• Access your personal data and get a copy of it.
• Correct or complete your data if it’s wrong or out of date.
• Ask us to stop using your data, and to delete or destroy it.
• Withdraw your consent at any time.
• Ask us to pause or limit how we use your data.
• Object to a decision made only by automated processing, including profiling, that has legal effects on you or affects you significantly. We don’t profile you, and our staff decide when to send invitations. The only automatic steps are giving out membership numbers in the order payments clear, and refunding a payment we can’t accept.
• Get your data in a commonly used format that a computer can read, and have it sent to another organization where the law allows.
• Take legal action and claim compensation if we breach your rights under the law, and complain to the authority responsible for personal data protection in Indonesia.

How to use them

Email hello@hpc.co.id, ideally from the address you gave us, and tell us what you’d like. We may ask you to confirm it’s you before we act. We’ll respond within the time Indonesian law requires.

Some rights have limits under the law. For example, we may need to keep payment records even if you ask us to delete your data. If you ask us to delete your details, you’ll leave the HPC list.

How we protect it

Here’s how we protect your data:

• Data travels to and from the site over encrypted connections.
• Your browser can’t read our database. Only our own server code can.
• Only authorized staff can see personal data. They sign in with a one-time email link, and only approved email addresses get in.
• Payments are handled by Midtrans on its own secure page, so we never hold your full card number, card security code or banking login.

No system is perfectly secure, but we work to keep the risk low.

If your data is exposed

If a security breach exposes your personal data, we’ll notify you and the authority responsible for personal data protection, as Indonesian law requires and within the time it requires. We’ll tell you what data was involved, when and how it happened, and what we’re doing to contain it and recover.

Children

If you’re under 18, ask a parent or guardian before you give us your details. If you think a child has given us their details without a parent’s or guardian’s consent, email hello@hpc.co.id and we’ll delete them.

Cookies

• When you visit this site, we don’t set cookies or store anything in your browser. Our analytics work without cookies.
• Our staff area uses cookies to keep staff signed in. They’re strictly necessary, and they’re only set when someone uses the staff sign-in.
• Midtrans runs its payment page on its own site, and it may use its own cookies there.

Changes to this notice

When the way we handle personal data changes, we’ll update this notice and its effective date. Before a change to what we collect, why we use it, or how long we keep it takes effect, we’ll tell the people it affects by email.

Contact

Hustle Lifestyle Collective, operating Hustle Performance Center (HPC).

Email hello@hpc.co.id with any privacy question, request or complaint.